Search code examples
windowsregistryformathive

windows registry hive files documentation

I need a document that describes format of Microsoft Windows registry hive file format. The only thing I was able to find is this one:

http://www.sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf

But it has nothing common with the real registry file format. Most of things described here doesn't work at all. For example, "Relative offset of next hive bin" is 0 in most of my local files. Pointer to start of last hbin in file points to the middle of hbin. I understand that Microsoft doesn't document this, however I know that people are writing parsers for registry files, so I think there should be one!

Does anybody know of a better document?

Solution

  • I am looking for something similar. Here is what I have found so far(except the article you mentioned):
    Manipulate Registry Hive files from C#
    hivex - Windows Registry "hive" extraction library

    Edit
    http://files.volatileminds.net/winreg.txt this link is less precise but to me more understandable than yours document

    Edit 2
    Article describing various registry parsing programs libhivex: Windows Registry hive extractor library